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The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )£3 Responsive to communication(s) filed on 19 September 2000 . 
2a)D This action is FINAL. 2b)M This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 
Disposition of Claims 

4) S Claim(s) 1-14 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) C3 Claim(s) 1-14 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) S The specification is objected to by the Examiner. 

10) S The drawing(s) filed on 19 September 2000 is/are: a)|3 accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

1 1) D The proposed drawing correction filed on is: a)D approved b)D disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) D The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§119 and 120 

13) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a)DAII b)D Some*c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 119(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121. 

Attachment(s) 

1) K Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-413) Paper No(s). . 

2) d Notice of Draftsperson's Patent Drawing Review (PTO-948) 5) CD Notice of Informal Patent Application (PTO-1 52) 

3) S Information Disclosure Statement(s) (PTO-1449) Paper No(s) 4^6 . 6) □ Other: 
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DETAILED ACTION 

1 . Pursuant to USC 1 3 1 , claims 1 - 1 4 are presented for examination. 

Specification 

2. The disclosure is objected to because of the following informalities: on page 4, line 15, 
reference number "115" should be —135--. 

Appropriate correction is required. 

Claim Rejections - 35 USC §102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another 
filed in the United States before the invention thereof by the applicant for patent, or on an 
international application by another who has fulfilled the requirements of paragraphs (1), 
(2), and (4) of section 371(c) of this title before the invention thereof by the applicant for 
patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act of 1999 
(AIPA) and the Intellectual Property and High Technology Technical Amendments Act of 2002 
do not apply when the reference is a U.S. patent resulting directly or indirectly from an 
international application filed before November 29, 2000. Therefore, the prior art date of the 
Reference is determined under 35 U.S.C. 102(e) prior to the amendment by the AIPA (pre-AIPA 
35 U.S.C. 102(e)). 
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3.1 Claims 1-11 and 13-14 are rejected under 35 U.S.C. 102(e) as being anticipated by US 
Patent 6,434,615 to Dinh et al.. 

3.2 As per claims 1 and 7, Dinh et al. discloses a computer-implemented process for 
assessing the vulnerability of a workstation to a security compromise, comprising the steps: 
issuing a request for a scanner from a browser operating on the workstation to a network server 
via a computer network (see column 7, lines 14-26); transmitting the scanner from the network 
server to the workstation via the computer network, the scanner installable within the browser 
and operative to complete a vulnerability assessment of the workstation (see column 7, lines 14- 
67); and generating workstation credentials in response to the scanner conducting the 
vulnerability assessment of the workstation (see column 7, lines 1-13 and lines 18 et seq.). 

As per claim 2, Dinh et al. discloses the limitation of further comprising the step of 
presenting the workstation credentials to the user of the workstation (see column 7, lines 21-26). 

As per claim 3, Dinh et al. discloses the limitation of further comprising the step of 
transmitting the workstation credentials to the network server via the computer network (see 
column 7, lines 27-35). 

As per claim 4, Dinh et al. discloses the limitation of further comprising the step of 
completing a repair operation by the scanner to address a security vulnerability identified by the 
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scanner in response to completing the vulnerability assessment of the workstation (see column 8, 
lines 24-36). 

As per claim 5 5 Dinh et al. discloses the limitation of wherein the scanner comprises a 
plug-in control operable with the browser and a data file defining security vulnerabilities (see 
column 8, lines 1 1-23). 

As per claims 6 and 14, Dinh et al. discloses the limitation of wherein the step of 
issuing a request for a scanner comprises the browser issuing a request for a Web page at the 
network server, the Web page hosting the scanner as a plug-in control available for installation 
with the browser (see column 7, lines 40-44). 

As per claims 8-10, Dinh et al. discloses a computer-implemented process for 
authenticating a workstation requesting a software service, comprising the steps: issuing a 
request for a scanner to a network server from a browser operating on the workstation (see 
column 7, lines 14-26); transmitting the scanner and a workstation policy from the network 
server to the workstation via the computer network, the scanner installable within the browser 
and operative to generate workstation credentials by completing a vulnerability assessment of the 
workstation (see column 7, lines 27-64 and column 8, lines 24-33); comparing the workstation 
credentials to the workstation policy on the workstation to determine whether the workstation 
should be granted access to the software service (see column 7, lines 27-64 and column 8, lines 
24-33). 
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As per claim 9, Dinh et al. discloses the limitation of wherein the step of issuing a 
request for a scanner comprises the browser issuing a request for a Web page at the network 
server, the Web page hosting the scanner as a control operable with the browser (see column 7, 
lines 40-44). 

As per claims 11 and 13, claim 1 1 recites some of the limitations of the rejected claims 1 
and 8. Therefore claim 1 1 is rejected on the same rationale as the rejection of claims 1 and 8. 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject matter 
sought to be patented and the prior art are such that the subject matter as a whole would have 
been obvious at the time the invention was made to a person having ordinary skill in the art to 
which said subject matter pertains. Patentability shall not be negatived by the manner in which 
the invention was made. 

4.1 Claim 12 is rejected under 35 U.S.C. 103(a) as being unpatentable over US Patent 
6,434,615 to Dinh et al. in view of US Patent 6,584,454 to Hummel, Jr. et al.. 
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4.2 As per claim 12, Dinh et al. substantially teaches the limitation of wherein the network 
server comprises a CGI script and the step of determining whether the workstation should be 
granted access to the network service comprises the CGI script comparing the workstation 
credentials to a workstation security policy maintained at the network server to determine 
whether the workstation should be granted access to the network service (see column 7, lines 27- 
64 and column 8, lines 24-33); if the workstation credentials satisfy the workstation security 
policy, then authorizing access to the network service and directing the browser to the 
log-in page via the computer network, otherwise, denying access to the network service and 
delivering an access denied page to the workstation via the computer network. Dinh et al. 
discloses that the invention can be embodied in corporate network (see column 8, line 24-33) 
wherein security would be more of a factor, but does not explicitly state displaying a log- in page 
and access denied page. It is well known in the art that if the request is valid the browser will 
display a log-in page otherwise a denied page. However, Hummel, Jr. et al. in an analogous art 
teaches providing a log-in page and providing an error message when denying access to the 
network service (see column 9, line 44 through column 10, line 12). Therefore, it would have 
been obvious to one of ordinary skill in the art at the time the invention was made to modify the 
method of Dinh et al. to provide an error page as taught by Hummel, Jr. et al. to provide 
delivery of protected software wherein business rules are utilized to authenticate and authorize 
access to users (see abstract). This modification would have been obvious because one skilled in 
the art would have been motivated by the suggestions provided by Hummel, Jr. et al.2 so as to 
authenticate and authorize access to users. 
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Conclusion 

5. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure as the art discloses the use of servicing workstations through browser application. 
US Patent: 6,429,952 Olbricht 

5. 1 Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Carl Colin whose telephone number is 703-305-0355. The 
examiner can normally be reached on Monday through Thursday, 8:00-6:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 703-305-9648. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is 703-305-3900. 

Carl Colin 
Patent Examiner 
March 5, 2004 
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